diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 87d683fc2ea6..97179337e778 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5553,6 +5553,12 @@
     matrix = "@chris:netsoj.nl";
     name = "Chris Josten";
   };
+  henkery = {
+    email = "jim@reupload.nl";
+    github = "henkery";
+    githubId = 1923309;
+    name = "Jim van Abkoude";
+  };
   henrikolsson = {
     email = "henrik@fixme.se";
     github = "henrikolsson";
diff --git a/pkgs/servers/code-server/build-vscode-nogit.patch b/pkgs/servers/code-server/build-vscode-nogit.patch
new file mode 100644
index 000000000000..aee2a033a80b
--- /dev/null
+++ b/pkgs/servers/code-server/build-vscode-nogit.patch
@@ -0,0 +1,26 @@
+--- ./ci/build/build-vscode.sh
++++ ./ci/build/build-vscode.sh
+@@ -45,14 +45,12 @@
+   # Set the commit Code will embed into the product.json.  We need to do this
+   # since Code tries to get the commit from the `.git` directory which will fail
+   # as it is a submodule.
+-  export VSCODE_DISTRO_COMMIT
+-  VSCODE_DISTRO_COMMIT=$(git rev-parse HEAD)
++  export VSCODE_DISTRO_COMMIT=none
+ 
+   # Add the date, our name, links, and enable telemetry (this just makes
+   # telemetry available; telemetry can still be disabled by flag or setting).
+   # This needs to be done before building as Code will read this file and embed
+   # it into the client-side code.
+-  git checkout product.json             # Reset in case the script exited early.
+   cp product.json product.original.json # Since jq has no inline edit.
+   jq --slurp '.[0] * .[1]' product.original.json <(
+     cat << EOF
+@@ -99,7 +97,6 @@
+   # Reset so if you develop after building you will not be stuck with the wrong
+   # commit (the dev client will use `oss-dev` but the dev server will still use
+   # product.json which will have `stable-$commit`).
+-  git checkout product.json
+ 
+   popd
+ 
diff --git a/pkgs/servers/code-server/default.nix b/pkgs/servers/code-server/default.nix
index 4a8d19687f7f..44edf3be7a81 100644
--- a/pkgs/servers/code-server/default.nix
+++ b/pkgs/servers/code-server/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchFromGitHub, buildGoModule, makeWrapper, runCommand
 , cacert, moreutils, jq, git, rsync, pkg-config, yarn, python3
-, esbuild, nodejs-14_x, node-gyp, libsecret, xorg, ripgrep
-, AppKit, Cocoa, CoreServices, Security, cctools, xcbuild }:
+, esbuild, nodejs-16_x, node-gyp, libsecret, xorg, ripgrep
+, AppKit, Cocoa, CoreServices, Security, cctools, xcbuild, quilt }:
 
 let
   system = stdenv.hostPlatform.system;
 
-  nodejs = nodejs-14_x;
+  nodejs = nodejs-16_x;
   python = python3;
   yarn' = yarn.override { inherit nodejs; };
-  defaultYarnOpts = [ "frozen-lockfile" "non-interactive" "no-progress"];
+  defaultYarnOpts = [ ];
 
   # replaces esbuild's download script with a binary from nixpkgs
   patchEsbuild = path : version : ''
@@ -21,28 +21,28 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "code-server";
-  version = "4.0.1";
-  commit = "7fe23daf009e5234eaa54a1ea5ff26df384c47ac";
+  version = "4.8.3";
 
   src = fetchFromGitHub {
-    owner = "cdr";
+    owner = "coder";
     repo = "code-server";
     rev = "v${version}";
-    sha256 = "1s3dcmzlkyh7qfs3ai1p7dlp45iys0ax1fbxxz17p395pw9anrrl";
+    fetchSubmodules = true;
+    sha256 = "1h5ng60wf3gpsydfkv20x30xsw1f5zcvv77l1mzrqz1mhcw93lvz";
   };
 
   cloudAgent = buildGoModule rec {
     pname = "cloud-agent";
-    version = "0.2.3";
+    version = "0.2.6";
 
     src = fetchFromGitHub {
-      owner = "cdr";
+      owner = "coder";
       repo = "cloud-agent";
       rev = "v${version}";
-      sha256 = "14i1qq273f0yn5v52ryiqwj7izkd1yd212di4gh4bqypmmzhw3jj";
+      sha256 = "1s3jpgvzizc9skc27c3x35sya2p4ywhvdi3l73927z3j47wszy7f";
     };
 
-    vendorSha256 = "0k9v10wkzx53r5syf6bmm81gr4s5dalyaa07y9zvx6vv5r2h0661";
+    vendorSha256 = "14xzlbmki8fk8mbcci62q8sklyd0nyga07ww1ap0vdrv7d1g31hn";
 
     postPatch = ''
       # the cloud-agent release tag has an empty version string, so add it back in
@@ -66,16 +66,20 @@ in stdenv.mkDerivation rec {
         xargs -I {} yarn --cwd {} \
           --frozen-lockfile --ignore-scripts --ignore-platform \
           --ignore-engines --no-progress --non-interactive
+
+      find ./lib/vscode -name "yarn.lock" -printf "%h\n" | \
+        xargs -I {} yarn --cwd {} \
+          --ignore-scripts --ignore-engines
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
 
     # to get hash values use nix-build -A code-server.prefetchYarnCache
-    outputHash = "0qmfsirld1qfl2s26rxbpmvxsyj2pvzkgk8w89zlrgbhgc5fj8p9";
+    outputHash = "0jzzbmmgv1nfq975mi9ii9l6c4f1wy10fyy117xgm4s6vxana7qn";
   };
 
   nativeBuildInputs = [
-    nodejs yarn' python pkg-config makeWrapper git rsync jq moreutils
+    nodejs yarn' python pkg-config makeWrapper git rsync jq moreutils quilt
   ];
   buildInputs = lib.optionals (!stdenv.isDarwin) [ libsecret ]
     ++ (with xorg; [ libX11 libxkbfile ])
@@ -86,6 +90,8 @@ in stdenv.mkDerivation rec {
   patches = [
     # remove download of coder-cloud agent
     ./remove-cloud-agent-download.patch
+    # remove git calls from vscode build script
+    ./build-vscode-nogit.patch
   ];
 
   postPatch = ''
@@ -133,79 +139,68 @@ in stdenv.mkDerivation rec {
     # install code-server dependencies
     yarn --offline --ignore-scripts
 
+    # apply patches
+    quilt push -a
+
     # patch shebangs of everything to allow binary packages to build
     patchShebangs .
 
-    # Skip shellcheck download
-    jq "del(.scripts.preinstall)" node_modules/shellcheck/package.json | sponge node_modules/shellcheck/package.json
+    export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+    export SKIP_SUBMODULE_DEPS=1
+    export NODE_OPTIONS=--openssl-legacy-provider
 
     # rebuild binary packages now that scripts have been patched
-    npm rebuild
+    echo "----- NPM rebuild"
+    npm rebuild --prefer-offline
 
     # Replicate ci/dev/postinstall.sh
     echo "----- Replicate ci/dev/postinstall.sh"
     yarn --cwd "./vendor" install --modules-folder modules --offline --ignore-scripts --frozen-lockfile
 
-    # Replicate vendor/postinstall.sh
-    echo " ----- Replicate vendor/postinstall.sh"
-    yarn --cwd "./vendor/modules/code-oss-dev" --offline --frozen-lockfile --ignore-scripts install
-
     # remove all built-in extensions, as these are 3rd party extensions that
     # get downloaded from vscode marketplace
-    jq --slurp '.[0] * .[1]' "vendor/modules/code-oss-dev/product.json" <(
+    jq --slurp '.[0] * .[1]' "./lib/vscode/product.json" <(
       cat << EOF
     {
       "builtInExtensions": []
     }
     EOF
-    ) | sponge vendor/modules/code-oss-dev/product.json
+    ) | sponge ./lib/vscode/product.json
 
     # disable automatic updates
     sed -i '/update.mode/,/\}/{s/default:.*/default: "none",/g}' \
-      vendor/modules/code-oss-dev/src/vs/platform/update/common/update.config.contribution.ts
-
-    # put ripgrep binary into bin, so postinstall does not try to download it
-    find -name vscode-ripgrep -type d \
-      -execdir mkdir -p {}/bin \; \
-      -execdir ln -s ${ripgrep}/bin/rg {}/bin/rg \;
-
-    # Playwright is only needed for tests, we can disable it for builds.
-    # There's an environment variable to disable downloads, but the package makes a breaking call to
-    # sw_vers before that variable is checked.
-    patch -p1 -i ${./playwright.patch}
+      lib/vscode/src/vs/platform/update/common/update.config.contribution.ts
 
     # Patch out remote download of nodejs from build script
     patch -p1 -i ${./remove-node-download.patch}
 
-    # Replicate install vscode dependencies without running script for all vscode packages
-    # that require patching for postinstall scripts to succeed
-    find ./vendor/modules/code-oss-dev -path "*node_modules" -prune -o \
-      -path "./*/*/*/*/*" -name "yarn.lock" -printf "%h\n" | \
+    # Fetch packages for vscode
+    find ./lib/vscode -name "yarn.lock" -printf "%h\n" | \
         xargs -I {} yarn --cwd {} \
-          --frozen-lockfile --offline --ignore-scripts --ignore-engines
-
+          --frozen-lockfile --ignore-scripts --ignore-engines
 
     # patch shebangs of everything to allow binary packages to build
     patchShebangs .
 
-    ${patchEsbuild "./vendor/modules/code-oss-dev/build" "0.12.6"}
-    ${patchEsbuild "./vendor/modules/code-oss-dev/extensions" "0.11.23"}
-  '' + lib.optionalString stdenv.isDarwin ''
+    ${patchEsbuild "./lib/vscode/build" "0.12.6"}
+    ${patchEsbuild "./lib/vscode/extensions" "0.11.23"}
+    '' + lib.optionalString stdenv.isDarwin ''
     # use prebuilt binary for @parcel/watcher, which requires macOS SDK 10.13+
     # (see issue #101229)
-    pushd ./vendor/modules/code-oss-dev/remote/node_modules/@parcel/watcher
+    pushd ./lib/vscode/remote/node_modules/@parcel/watcher
     mkdir -p ./build/Release
     mv ./prebuilds/darwin-x64/node.napi.glibc.node ./build/Release/watcher.node
     jq "del(.scripts) | .gypfile = false" ./package.json | sponge ./package.json
     popd
   '' + ''
-    # rebuild binaries, we use npm here, as yarn does not provide an alternative
-    # that would not attempt to try to reinstall everything and break our
-    # patching attempts
-    npm rebuild --prefix vendor/modules/code-oss-dev --update-binary
+
+    # put ripgrep binary into bin, so postinstall does not try to download it
+    find -name ripgrep -type d \
+      -execdir mkdir -p {}/bin \; \
+      -execdir ln -s ${ripgrep}/bin/rg {}/bin/rg \;
 
     # run postinstall scripts after patching
-    find ./vendor/modules/code-oss-dev -path "*node_modules" -prune -o \
+    find ./lib/vscode -path "*node_modules" -prune -o \
       -path "./*/*/*/*/*" -name "yarn.lock" -printf "%h\n" | \
         xargs -I {} sh -c 'jq -e ".scripts.postinstall" {}/package.json >/dev/null && yarn --cwd {} postinstall --frozen-lockfile --offline || true'
 
@@ -233,7 +228,7 @@ in stdenv.mkDerivation rec {
     ln -s "${cloudAgent}/bin/cloud-agent" $out/libexec/code-server/lib/coder-cloud-agent
 
     # create wrapper
-    makeWrapper "${nodejs-14_x}/bin/node" "$out/bin/code-server" \
+    makeWrapper "${nodejs-16_x}/bin/node" "$out/bin/code-server" \
       --add-flags "$out/libexec/code-server/out/node/entry.js"
   '';
 
@@ -249,9 +244,9 @@ in stdenv.mkDerivation rec {
       code-server is VS Code running on a remote server, accessible through the
       browser.
     '';
-    homepage = "https://github.com/cdr/code-server";
+    homepage = "https://github.com/coder/code-server";
     license = licenses.mit;
-    maintainers = with maintainers; [ offline ];
+    maintainers = with maintainers; [ offline henkery ];
     platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/servers/code-server/remove-cloud-agent-download.patch b/pkgs/servers/code-server/remove-cloud-agent-download.patch
index 0b16e16aec8b..94590bbcd43e 100644
--- a/pkgs/servers/code-server/remove-cloud-agent-download.patch
+++ b/pkgs/servers/code-server/remove-cloud-agent-download.patch
@@ -1,17 +1,17 @@
 --- ./ci/build/npm-postinstall.sh
 +++ ./ci/build/npm-postinstall.sh
-@@ -58,14 +58,6 @@
-
-   OS="$(uname | tr '[:upper:]' '[:lower:]')"
-
+@@ -102,14 +102,6 @@
+     ;;
+   esac
+ 
 -  mkdir -p ./lib
 -
--  if curl -fsSL "https://github.com/cdr/cloud-agent/releases/latest/download/cloud-agent-$OS-$ARCH" -o ./lib/coder-cloud-agent; then
+-  if curl -fsSL "https://github.com/coder/cloud-agent/releases/latest/download/cloud-agent-$OS-$ARCH" -o ./lib/coder-cloud-agent; then
 -    chmod +x ./lib/coder-cloud-agent
 -  else
 -    echo "Failed to download cloud agent; --link will not work"
 -  fi
 -
-   if ! vscode_yarn; then
+   if ! vscode_install; then
      echo "You may not have the required dependencies to build the native modules."
-     echo "Please see https://github.com/cdr/code-server/blob/master/docs/npm.md"
+     echo "Please see https://github.com/coder/code-server/blob/main/docs/npm.md"
diff --git a/pkgs/servers/code-server/remove-node-download.patch b/pkgs/servers/code-server/remove-node-download.patch
index 282d716752f2..d19d4a2b5bf7 100644
--- a/pkgs/servers/code-server/remove-node-download.patch
+++ b/pkgs/servers/code-server/remove-node-download.patch
@@ -1,15 +1,16 @@
---- ./vendor/modules/code-oss-dev/build/gulpfile.reh.js
-+++ ./vendor/modules/code-oss-dev/build/gulpfile.reh.js
-@@ -277,8 +277,6 @@
+--- ./lib/vscode/build/gulpfile.reh.js
++++ ./lib/vscode/build/gulpfile.reh.js
+@@ -268,9 +268,6 @@
  			.pipe(util.stripSourceMappingURL())
  			.pipe(jsFilter.restore);
  
--		const nodePath = `.build/node/v${nodeVersion}/${platform}-${platform === 'darwin' ? 'x64' : arch}`;
+-		const nodePath = `.build/node/v${nodeVersion}/${platform}-${arch}`;
 -		const node = gulp.src(`${nodePath}/**`, { base: nodePath, dot: true });
- 
+-
  		let web = [];
  		if (type === 'reh-web') {
-@@ -296,7 +294,6 @@
+ 			web = [
+@@ -287,7 +284,6 @@
  			license,
  			sources,
  			deps,
@@ -17,11 +18,11 @@
  			...web
  		);
  
-@@ -376,7 +373,6 @@
+@@ -385,7 +381,6 @@
  			const destinationFolderName = `vscode-${type}${dashed(platform)}${dashed(arch)}`;
  
  			const serverTaskCI = task.define(`vscode-${type}${dashed(platform)}${dashed(arch)}${dashed(minified)}-ci`, task.series(
--				gulp.task(`node-${platform}-${platform === 'darwin' ? 'x64' : arch}`),
+-				gulp.task(`node-${platform}-${arch}`),
  				util.rimraf(path.join(BUILD_ROOT, destinationFolderName)),
  				packageTask(type, platform, arch, sourceFolderName, destinationFolderName)
  			));